Analysis
- max time kernel
98s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
20/10/2026, 01:03
Behavioral task
behavioral1
Sample
sora.x86.elf
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
8 signatures
150 seconds
General
- Target sora.x86.elf
- Size 58KB
- Sample261020-behynatsfw
- SHA256 279f00a0c21d82b034c633a5b247a50b9f2b2921416d48e5aafc07c42fe31d9d
- MD5 56ca49e06b73e51e15db5d911f7ab471
- SHA1 7a35470fcda0b048e0212e6e7deed1340d923064
- SHA512 5fd4084ed7892ba1fe42958f30c920c435ea55ddce7b438516b6bcae5fa2d22f959e71b8a1ece25681992ee565441cad1ab4eb02371548f9cf93d4f3913696bb
- SSDEEP 1536:MOssuiundFq4ZthwLi/pXUfx0WbEoPRdQZl7dDFfG:xzuXndFq4ZthB/VUfOW4oPnQj7dhO
- TLSH T1FE434AC4B183FAF1DC05017C307AEB326E37F0B6613AED9BD7E455B36855206960AA9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (89697) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog sora.x86.elf File opened for modification /dev/misc/watchdog sora.x86.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp sora.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1506 sora.x86.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp sora.x86.elf -
description ioc Process File opened for reading /proc/1015/fd sora.x86.elf File opened for reading /proc/1041/fd sora.x86.elf File opened for reading /proc/1137/fd sora.x86.elf File opened for reading /proc/1140/fd sora.x86.elf File opened for reading /proc/1507/exe sora.x86.elf File opened for reading /proc/1510/exe sora.x86.elf File opened for reading /proc/528/fd sora.x86.elf File opened for reading /proc/645/fd sora.x86.elf File opened for reading /proc/918/fd sora.x86.elf File opened for reading /proc/958/fd sora.x86.elf File opened for reading /proc/1080/fd sora.x86.elf File opened for reading /proc/1338/fd sora.x86.elf File opened for reading /proc/450/fd sora.x86.elf File opened for reading /proc/653/fd sora.x86.elf File opened for reading /proc/932/fd sora.x86.elf File opened for reading /proc/955/fd sora.x86.elf File opened for reading /proc/1006/fd sora.x86.elf File opened for reading /proc/1020/fd sora.x86.elf File opened for reading /proc/1028/fd sora.x86.elf File opened for reading /proc/1075/fd sora.x86.elf File opened for reading /proc/267/fd sora.x86.elf File opened for reading /proc/589/fd sora.x86.elf File opened for reading /proc/635/fd sora.x86.elf File opened for reading /proc/654/fd sora.x86.elf File opened for reading /proc/913/fd sora.x86.elf File opened for reading /proc/1071/fd sora.x86.elf File opened for reading /proc/1143/fd sora.x86.elf File opened for reading /proc/1232/fd sora.x86.elf File opened for reading /proc/511/fd sora.x86.elf File opened for reading /proc/709/fd sora.x86.elf File opened for reading /proc/896/fd sora.x86.elf File opened for reading /proc/979/fd sora.x86.elf File opened for reading /proc/1024/fd sora.x86.elf File opened for reading /proc/1043/fd sora.x86.elf File opened for reading /proc/1083/fd sora.x86.elf File opened for reading /proc/1126/fd sora.x86.elf File opened for reading /proc/451/fd sora.x86.elf File opened for reading /proc/539/fd sora.x86.elf File opened for reading /proc/567/fd sora.x86.elf File opened for reading /proc/891/fd sora.x86.elf File opened for reading /proc/1038/fd sora.x86.elf File opened for reading /proc/1057/fd sora.x86.elf File opened for reading /proc/1073/fd sora.x86.elf File opened for reading /proc/1226/fd sora.x86.elf File opened for reading /proc/1/fd sora.x86.elf File opened for reading /proc/590/fd sora.x86.elf File opened for reading /proc/1011/fd sora.x86.elf File opened for reading /proc/1055/fd sora.x86.elf File opened for reading /proc/1285/fd sora.x86.elf File opened for reading /proc/1331/fd sora.x86.elf File opened for reading /proc/1497/fd sora.x86.elf File opened for reading /proc/1510/fd sora.x86.elf File opened for reading /proc/423/fd sora.x86.elf File opened for reading /proc/483/fd sora.x86.elf File opened for reading /proc/1037/fd sora.x86.elf File opened for reading /proc/1058/fd sora.x86.elf File opened for reading /proc/1292/fd sora.x86.elf File opened for reading /proc/1507/fd sora.x86.elf File opened for reading /proc/338/fd sora.x86.elf File opened for reading /proc/456/fd sora.x86.elf File opened for reading /proc/1085/fd sora.x86.elf File opened for reading /proc/1301/fd sora.x86.elf File opened for reading /proc/1365/fd sora.x86.elf File opened for reading /proc/1473/fd sora.x86.elf